Your if condition is matching your new URL once you've redirected back with the bypass_verification parameter set. Since this still matches your condition, you are getting what appears to be a loop. You need to change your logic so that window.location.href doesn't get reassigned if it already contains bypass_verification=true.